Random account set to Administrator?

[ThatGreenAlien]

Today I woke up to see the newest member, some random account named qaz001 was in the administrator group? We banned them before anything was done, but what is this and what can we do to stop it? Is this like a hack or something? :eek:

I did a google search on the name, and a lot of other random boards have the same account set as an administrator... what's up with this?

[ForceHSS]

Yes its a hacker u would be best to do a full check and plug the hole were they got in

[ThatGreenAlien]

Okay, I'm pretty new to server stuff, what should I do exactly? And I looked in their log and saw something with plugin.php, what should I be looking for?

[Paul M]

Have you folowed the recent security advice and removed your install folder ? Thats almost certainly how they created the account.

[ThatGreenAlien]

I'll check that when I get home. Thanks!!

Edit: All install folders have been deleted. Anything else?

[ozzy47]

Then please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked (http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked)

http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site)

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5 (http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5)
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions (http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3993204-vbulletin-5-connect-security-patches-released-all-versions)

[afonseca]

Hi, I'm having the exact same issue, down to the username that was used. I banned those accounts and the hacker started creating other named accounts also in the Administrators group. The links on vbulletin.com are throwing this error:
"An internal error has occurred and the module cannot be displayed."

Did vbulletin.com get hacked? Any help appreciated.

[ForceHSS]

Hi, I'm having the exact same issue, down to the username that was used. I banned those accounts and the hacker started creating other named accounts also in the Administrators group. The links on vbulletin.com are throwing this error:
"An internal error has occurred and the module cannot be displayed."

Did vbulletin.com get hacked? Any help appreciated.

Sorry are we talking about ur forum being hacked or are u asking that vbulletin has also been hacked

[afonseca]

I was referring to vbulletin.com there as none of the links shared were working for me, they were throwing that error message. They seem to be working fine now.

[Grimes]

Today I woke up to see the newest member, some random account named qaz001 was in the administrator group? We banned them before anything was done, but what is this and what can we do to stop it? Is this like a hack or something? :eek:

I did a google search on the name, and a lot of other random boards have the same account set as an administrator... what's up with this?

I have the same exact thing happening. Same user, same situation. The email is qwe@qwe.com and the ip is the same each time out of the Ukraine. It comes up in spam ip searches online. They were able to set the usergroup to admin and registration ip is blank. I believe I caught it in time, but I noticed that that same user account was created multiple times, and their location under 'who's online' was plugin.php?do=doimport&do=doimport.

Check your plugins for strange plugins. I had multiple entries (one for each account) of a plugin titled 'ech' that uses the hook init_startup. I deleted them all. This just happened moments ago. I had registration turned off, but it was still creating that same account. Banning the username and ip + email seems to have stopped it. Bizarre. I'm in the process of a security check right now to see if there's a hole somewhere.

[ozzy47]

Follow the links in post #6

[tbworld]

Today I woke up to see the newest member, some random account named qaz001 was in the administrator group? We banned them before anything was done, but what is this and what can we do to stop it? Is this like a hack or something? :eek:

I did a google search on the name, and a lot of other random boards have the same account set as an administrator... what's up with this?

Prior to being hacked was your install directory already removed. I am curious?

--------------- Added 1381361252 at 1381361252 ---------------

I have the same exact thing happening.

Prior to being hacked was your install directory already removed. I am curious?

[ozzy47]

Even if it was, the site could have been compromised before hand, and the script was not executed before today.

[Grimes]

No! Son of a...it wasn't deleted. That's likely the cause then. Removed it. Thank you.

[tbworld]

Even if it was, the site could have been compromised before hand, and the script was not executed before today.

I did realize that, but there was no question I could ask that would insure the desired response. So I am just data collecting.

[ozzy47]

Well ain't that a kick in the bullocks, Now I would definitely follow the links in post #6.

[afonseca]

Thanks for sharing, I noticed the same plugins "ech" installed with the following code:


if(isset($_GET["ech"])) {
echo("0101");
exit;
}


I've just deleted them.

[DoubleGlasses]

I am dealing with exactly this -

SO 2 weeks ago - I came to my site and found this
https://vborg.vbsupport.ru/external/2013/10/56.png

Imagine my horror lol!

I tried to lock everything down , removed the bad code and all was quiet. Then 2 weeks later - I get a malicious code warning from my google chrome. I check my admins and Voila! There are like 10 new admins added to my site! So again I locked everything down. Then this morning I wake up to see 10 new registrations - and guess what - they are exactly like what's posted above. So I realize that I never really deleted my install folder.. in fact i just removed the install file to deactivate it. So I'm off to follow the instructions on the links and to try again. I think I"ll be doing a fresh install of VB anyway and deleting all of my plugins till I get to the bottom of this.

Also - I looked in that ech plugin ( and I have 6 of them...) - and this is what I see :
https://vborg.vbsupport.ru/external/2013/10/57.png

[tbworld]

Make sure you read through this thread and especially the post from @ozzy47 and follow the current guidelines -- if you have not already. Sorry you were hacked.

[DoubleGlasses]

Thanks - I'm actually going down that list meticulously and working on locking the site down AGAIN!I'm soo appreciative of you guys and sharing this info...

[tbworld]

Good luck, were around :)

[ice9]

I noticed a couple dozen 'qaz001' Administrator accounts yesterday on my forum too. I deleted the accounts, and deleted the install directory. On my site, no nefarious plugins had been installed. I think what saved us was .htaccess password protection on the admincp directory. The real danger was almost dying of a heart attack when I saw all those unknown admin accounts!

If you google for inurl:/forum qaz001 administrator you can see that a lot of these accounts have been added to many forums recently.

[RedTurtle]

Thanks for sharing, I noticed the same plugins "ech" installed with the following code:


if(isset($_GET["ech"])) {
echo("0101");
exit;
}


I've just deleted them.

Anyone have any idea what this plugin code is doing?

[ice9]

It looks like a way to detect which forums have been successfully compromised.

Google for a compromised forum, as described in my last post. Then, append &ech to the url. You should see a blank page that contains only "0101".

So, maybe it goes like this:

1. Use /install directory exploit to add new admin users.
2. Login to admincp interface, and install plugin.
3. Check which forums return "0101" when &ech is appended to their url.
4. Deface the forums that are returning "0101".

--------------- Added 1381433980 at 1381433980 ---------------

Here's the IP and user agent that tried to access my admincp directory on Oct. 9th, and failed about 30 times:

178.158.214.36
Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0

Also, this IP, same user agent: 46.183.218.214 .

It's going like this (I've asterisked out my admincp directory):

178.158.214.36 - - [09/Oct/2013:15:26:43 -0500] "GET /forum/install/upgrade.php HTTP/1.0" 200 13295 "-" "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0"
178.158.214.36 - - [09/Oct/2013:15:26:44 -0500] "POST /forum/install/upgrade.php HTTP/1.0" 200 279 "-" "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0"
178.158.214.36 - - [09/Oct/2013:15:26:45 -0500] "GET /forum/******/index.php HTTP/1.0" 401 401 "-" "Mozilla/5.0 (Windows NT 6.1; rv:24.0) Gecko/20100101 Firefox/24.0"

Looks like they're testing for the existence of /forum/install/upgrade.php, then POST'ing to it (assumedly adding the new admin username). Then they try to access the admincp directory, but you can see here how they're being denied (401) because of the .htaccess directory protection on the admincp directory.

[michelle86]

I had the same qaz001 admin accounts on my website - several of them. I also had the ech plugin - about 5 of them. Deleted them.

Also check your clientscript directory. Under vbulletincss there were a bunch of files that had been added the other day on my website - same day the accounts had been created. Deleted those too.

[ThatGreenAlien]

Sorry for the late response. We hadn't cleared the install folder previous to the hack however afterwards we deleted the folder, the account, and that weird plugin (we had it too) and so far we've been alright!